Vulnerability SLA tracking

Assigns every open finding an owner and a deadline, and escalates only the ones about to breach.

macOS — coming soonSee the 4 automations
IT / AUTOMATE.md

When a critical CVE is published, check the asset list for the affected product, open one ticket per owner, and post the host count and the patch deadline.

Ready-made: Critical CVE Triage

The job, and what good looks like.

Scanners produce tens of thousands of findings and nobody agrees which ones matter this month. Exceptions live in a spreadsheet, deadlines pass quietly, and the same finding on the same internet-facing host is patched for the fourth time without anyone looking at why it keeps coming back. The workflow sorts the queue instead of adding to it. It joins each open finding to the asset, the business owner, how exposed that asset is, and a severity that reflects both. From that it assigns one owner and one deadline, and it refuses to accept an exception without a named approver, a reason and an expiry date. Findings that are three days from their deadline are escalated to the owner and their manager, so the escalation happens before the breach rather than after it. Findings that reappear on the same host are grouped together so the coverage gap behind them is fixed once rather than four times. A human approves every exception, every deadline change, and every risk acceptance.

When it is handled

  • No finding past deadline without an approved exception
  • Repeat findings traced to one root cause
  • Oldest internet-facing finding under 7 days

Works with tools like

  • Qualys
  • Tenable.io
  • Rapid7 InsightVM
  • Jira Service Management

Ready-made automations. Pick the one that fits.

Each one is a plain-language document. Run it as it is, or change the timing, the rules and the tools to match your team.

Critical CVE Triage

When a critical CVE is published, check the asset list for the affected product, open one ticket per owner, and post the host count and the patch deadline.

When a critical CVE is published for a product in the asset list

Repeat Finding Root Cause

On the first Monday, group the findings that have reappeared on the same host, then open one ticket per host naming the coverage gap that let it back in.

On the first Monday of each month

SLA Breach Escalation

Every weekday at 9am, pull findings within three days of deadline that have no approved exception, and escalate them to the owner and that owner's manager.

Every weekday at 9:00am

Vulnerability Exception Approval

When an owner asks to accept a finding, pull the asset owner and the compensating control from the exception request, set an expiry date, and send it to the named approver for a decision.

When an owner asks for a finding to be accepted as a risk

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

Critical CVE Triage

Approve before it files the ticket and posts in Slack?

ReviewApprove

Before you download.

Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Already have tools for this? Here is the difference.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Related workflows.

Vulnerability reports

Builds the periodic report from the scanners themselves, so every open finding carries an owner, a deadline and a visible status.

Write your own

Patch window coordination

Sequences reboots so the same host is patched once, in dependency order, without a maintenance page.

4 automations

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Write your own

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon